Re: VS .NET & SDK vs. IIS LockDown & URLScan

From: Thomas Deml [MS] (thomad@online.microsoft.com)
Date: 10/06/02 

From: "Thomas Deml [MS]" <thomad@online.microsoft.com>
Date: Sun, 6 Oct 2002 01:34:18 -0700

Mark,

here is the typical problem vs.net developers face:
      Visual Studio

Error: The Web Server Has Been Locked Down and Is Blocking the DEBUG Verb
Stepping into a Web application or XML Web service failed because the IIS
lockdown tool has been run and URLScan has been installed and activated.
This condition blocks IIS from receiving the DEBUG verb.

URLScan is a security tool that works in conjunction with the IIS Lockdown
Tool to give IIS Web site administrators the ability to turn off unnecessary
features and restrict the type of HTTP requests that the server will
process. By blocking specific HTTP requests, the URLScan security tool
prevents potentially harmful requests from reaching the server and causing
damage.

To enable debugging on a Web server with URLScan installed

  1.. Locate the Urlscan.ini file. Normally, you will find it in a directory
that looks something like this:
C:\WINNT\System32\Inetsrv\urlscan2.. Create a copy of the file and name it
Urlscan.old.
  3.. Open the original copy of the Urlscan.ini file using Notepad or the
text editor of your choice.
  4.. In Urlscan.ini, locate the [AllowVerbs] section. Add DEBUG to the
[AllowVerbs] section. If you see ;DEBUG in the [AllowVerbs] section, you can
remove the semicolon (which comments out the verb).
  5.. Locate the [DenyVerbs] section. If DEBUG appears in the [DenyVerbs]
section, remove it.
  6.. Save the file.
  7.. Restart the server or restart IIS.
Hope this helps, 

--
Thomas Deml
Lead Program Manager
Internet Information Services
Microsoft Corp.
"Mark Chmiel" <markchm@microsoft.com> wrote in message
news:1083d01c26d0c$78555a90$36ef2ecf@tkmsftngxa12...
> I have recently installed Visual Studio .NET and the
> Framework SDK which required the installation of IIS.  I
> like to keep my system secure so I ran Microsoft Baseline
> Security Analyzer which suggested I run IISLOCKD.EXE and
> URLSCAN.  After doing so, my VS.NET SDK stopped
> functioning. What is the proper way to lockdown my IIS,
> use URLScan, and still be able to run the VS.NET SDK?  So
> far it looks like I need to disable security features to
> run the demos - that just doesn't make sense.

Relevant Pages

  • Re: URLscan problem
    ... I did indeed restart the IIS server after ... I took a look at the URLscan log files and found my ... >URLscan seems to be causing a problem with public folder ...
    (microsoft.public.inetserver.iis.security)
  • RE: W3SVC, SMTP, IISAdmin services stopping..hacking?
    ... That SEARCH request is indicative of an attempt to exploit the ... of URLScan blocks SEARCH requests such as this one. ... Internet Services Manager -> right click on your server name -> Properties ... does contain a number of other very important security fixes for IIS. ...
    (microsoft.public.inetserver.iis.security)
  • Re: ISAPI Filter:How to hide/modify the response header
    ... Here's the section from that URL which deals just with IIS HTTP information: ... The free IISlockdown tool from www.microsoft.com/download includes URLScan, ... which can be used to change or remove the banner from your web server. ...
    (microsoft.public.inetserver.iis.security)
  • Re: How do you hide the HTTP Server header?
    ... David Dietz -- IIS Technical Lead ... © 2001 Microsoft Corporation. ... |>Subject: Re: How do you hide the HTTP Server header? ... |>IISlockdown includes URLscan which is I think an excellent security tool, ...
    (microsoft.public.inetserver.iis.security)
  • [NT] Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise
    ... This patch eliminates a newly discovered vulnerability affecting Internet ... in IIS 4.0 and 5.0, and could likewise be used to overrun heap memory on ... allowing code to be run on the server. ... * Microsoft has long recommended disabling HTR functionality unless there ...
    (Securiteam)